Storing Passwords Safely in Java

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.HexFormat;
 
public class Weak {
    static String sha256(String text) throws Exception {
        return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
            .digest(text.getBytes(StandardCharsets.UTF_8)));
    }
 
    public static void main(String[] args) throws Exception {
        // Plain SHA-256, no salt: what NOT to do.
        String navika = sha256("password123");
        String advitha = sha256("password123");
        System.out.println(navika.substring(0, 24) + "...");
        System.out.println("Two users, same password, same hash? "
            + navika.equals(advitha));
 
        // How fast can an attacker try guesses?
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        long start = System.nanoTime();
        int guesses = 2_000_000;
        for (int i = 0; i < guesses; i++) {
            md.digest(("guess" + i).getBytes(StandardCharsets.UTF_8));
        }
        long ms = (System.nanoTime() - start) / 1_000_000;
        System.out.println(guesses + " guesses took " + ms + " ms");
    }
}

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.PBEKeySpec;
 
public class Passwords {
    static final String ALGORITHM = "PBKDF2WithHmacSHA256";
    static final int ITERATIONS = 600_000;
    static final int SALT_BYTES = 16;
    static final int KEY_BITS = 256;
    static final SecureRandom RANDOM = new SecureRandom();
 
    // The "database": user name -> stored password record.
    static final Map<String, String> USERS = new HashMap<>();
 
    static byte[] derive(char[] password, byte[] salt, int iterations)
            throws Exception {
        PBEKeySpec spec =
            new PBEKeySpec(password, salt, iterations, KEY_BITS);
        try {
            return SecretKeyFactory.getInstance(ALGORITHM)
                .generateSecret(spec).getEncoded();
        } finally {
            spec.clearPassword();
        }
    }
 
    // Returns "iterations:salt:hash", everything needed to check later.
    static String hash(char[] password) throws Exception {
        byte[] salt = new byte[SALT_BYTES];
        RANDOM.nextBytes(salt);
        byte[] key = derive(password, salt, ITERATIONS);
        Base64.Encoder b64 = Base64.getEncoder();
        return ITERATIONS + ":" + b64.encodeToString(salt) + ":"
            + b64.encodeToString(key);
    }
 
    static boolean matches(char[] password, String stored) throws Exception {
        String[] parts = stored.split(":");
        int iterations = Integer.parseInt(parts[0]);
        byte[] salt = Base64.getDecoder().decode(parts[1]);
        byte[] expected = Base64.getDecoder().decode(parts[2]);
        byte[] actual = derive(password, salt, iterations);
        return MessageDigest.isEqual(expected, actual);
    }
 
    static void register(String user, String password) throws Exception {
        USERS.put(user, hash(password.toCharArray()));
    }
 
    static boolean login(String user, String password) throws Exception {
        String stored = USERS.get(user);
        return stored != null && matches(password.toCharArray(), stored);
    }
 
    public static void main(String[] args) throws Exception {
        register("navika", "Correct-Horse-91");
        register("srihitha", "Correct-Horse-91");
 
        String record = USERS.get("navika");
        String[] parts = record.split(":");
        System.out.println("Stored record has " + parts.length
            + " parts: iterations=" + parts[0] + ", salt of "
            + Base64.getDecoder().decode(parts[1]).length
            + " bytes, hash of "
            + Base64.getDecoder().decode(parts[2]).length + " bytes");
        System.out.println("Record contains the password? "
            + record.contains("Correct-Horse-91"));
        System.out.println("Same password, same record for both users? "
            + record.equals(USERS.get("srihitha")));
 
        System.out.println("Login, right password: "
            + login("navika", "Correct-Horse-91"));
        System.out.println("Login, wrong password: "
            + login("navika", "correct-horse-91"));
        System.out.println("Login, unknown user:   "
            + login("advitha", "Correct-Horse-91"));
    }
}